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ABSTRACT 

The Cryogenic On-orbit Liquid Depot — Storage, Acquisition 

and Transfer (COLD-SAT) satellite presents some unique safety 
issues. The feasibility study conducted at the NASA Lewis 

Research Center desired a systems safety program that would be 
involved from the initial design in order to eliminate and/or 

control the inherent hazards. Because of this, a hazards analysis 
method was needed that: (1) identified issues that needed to be 

addressed for a feasibility assessment; and (2) identified all 
potential hazards that would need to be controlled and/or 
eliminated during the detailed design phases. This report 
presents the developed analysis method as well as the results 

generated for the COLD-SAT system. 


I . Introduction/Unique Requi r ament 8 

The Cryogenic On-Orbit Liquid Storage, Acquisition, and 
Transfer (COLD-SAT) satellite presents some unique considerations 
from a safety perspective. NASA Lewis Research Center has 
conducted feasibility studies for this free-flying orbital 
experiment with a planned launch by an expendable launch vehicle 
(ELV) in 1998. The purpose of COLD-SAT is to perform subcritical 
liquid hydrogen (LH 2 ) storage and transfer experiments under low- 
gravity conditions to provide engineering data for future space 
transportation missions. Gaseous hydrogen (GH 2 ) and gaseous helium 
(GHe) are also proposed for use in various components of the 
experiments . 

Liquid hydrogen was chosen as the experimental fluid for two 
reasons. First, its use as the primary liquid rocket propellant 
makes it an obvious candidate (it has the highest specific impulse 
of current rocket fuels) . Second, it will provide more restrictive 
(i.e. more conservative) data than other candidates, thereby making 
the experiment results broader and more applicable to other fluids. 

In addition to the usual safety concerns involved with 
launching a space vehicle, COLD-SAT creates additional concerns 
due to its use of cryogenic hydrogen. Ground and launch operations 
are tremendously affected by this and will be modified in support 
of safety evaluations. The use of hydrazine (N 2 H 4 ) , pyrotechnics, 
and pressure vessels on the spacecraft also provide the need for 
extensive safety input. 

The approach used for this safety analysis is as follows. 
First, a hazard definition matrix was developed. Second, hazard 
definitions were defined in conjunction with this matrix. Next, 
each of the defined hazards was classified based on its 
applicability to the feasibility study. Finally, the hazards 
considered to be major concerns were evaluated by the system 
designers and safety engineers in order to identify proper design 
approaches and safety considerations. Each of these items will be 
discussed in detail in succeeding sections. 

The intent of this analysis is to provide a baseline for the 
COLD-SAT program safety efforts. The structure of the analysis is 
such as to be very thorough, yet general in nature. Thus, the 
analysis can be viewed as a complete analysis of the COLD-SAT 
system and yet be applicable for use by any contractor that is 
elected to continue the effort. This analysis, as defined and 
presented in this report, should be used as the starting point for 
future preliminary design safety efforts. 

The bulk of the work is contained in the Appendices. Appendix 
A contains all the hazard definitions - the detailed analysis of 
the potential hazards of a system given a generic situation. 
Appendix B contains the classification of the defined hazards, i.e. 
whether or not the identified hazards required preliminary design 
action. Both of these Appendices will be described more fully in 
later sections. 
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II. Matrix Description 

The hazard definition matrix developed for the COLD-SAT 
project is a three-dimensional matrix with the following matrix 
dimensions: Cause Category, Hazard Group, and Operational Phase. 
The initial matrix is shown in Figure 1. The specific items, and 
their definitions relative to COLD-SAT are: 


Cause Category; 

A. Structural/Mechanical - any part of the structure or any 

mechanical component or system 


B. Hazardous Materials - LH2/GH2, N2H4, components or by- 

products of batteries, processing 
solvents, etc. 


C. Environmental - shock/vibration, temperature 

extremes, uninhabitable atmospheres, 
excessive moisture (rain or conden- 
sation), salt air, lightning, etc. 


D. Pneumatics/Pressurants - GHe, GH2, any ground operations 

pressurant, etc. 


E. Electrical/Electronic 

F . Ordnance 


any electrical or electronic 
component or system 

pyrotechnic valves, bolt/cable 
cutters (no shape charges), etc. 


G. Propulsion - N2H4, the thrusters, and the 

related plumbing and hardware 

H. Non-Ionizing Radiation - generated by high-energy radio 

waves 


I . Ground Support Equipment - any equipment used on the program 

that will not be launched 


Hazard Group: 

1. Collision/Mech . Damage - an impact, with force, of 

mechanical items 

2. Corrosion - structural degradation of metallic 

or non-metallic equipment (including 
hydrogen embrittlement) 
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FIGURE 1 COLD-SAT HAZARD MATRIX LeRC Feasibility Study 
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Operational Phases: 1. Launch site modifications 2 . Subsystem manufacture 3. Transportation 

5. Element test 6. System Integration 7. System test 

9. Countdown 10. Flight phase I 11. Right phase II 




Hazard Group (con't) : 


3. Contamination - the release, or cause of release, 

of toxic, flammable, corrosive, 
condensible, or particulate matter 

4. Electrical Shock/Short - personnel injury or equipment 

damage due to improper passage of 
electrical current 


5. Fire 


6. Explosion/Implosion 


- rapid oxidation of combustibles - 
combination of fuel, oxidizer, and 
an ignition source 

- a violent release or acceptance of 
energy due to pressure differentials 


7. Temperature Extremes - burning or freezing of skin or 

damage to equipment due to departure 
of temperature from normal 


Operational Phase: 


1. 

Launch Site Modifications- safety assessment to launch site 

ready 

2. 

Subsystem Manufacture 

- material receipt to pack and load 
complete 

3. 

Transportation 

- pack and load complete to arrival 
at CCAFS 

4. 

Element Assembly 

- arrival at CCAFS to element test 
start 

5. 

Element Test 

element test start to system 
assembly start 

6. 

System Integration 

- system assembly start to system 
test start 

7. 

System Test 

- system test start to pre-launch 
servicing start 

8. 

Pre-launch Service 

pre-launch servicing start to 
countdown start 

9. 

Countdown 

- countdown start to launch 


5 



Operational Phase (con't) : 


10. 

Flight Phase I 

- launch to arrive park orbit 

11. 

Flight Phase II 

- arrive park orbit to arrive final 
orbit 

12. 

Payload Separation 

arrive final orbit to payload 
separation 


The matrix was developed by taking applicable features of many 
different system safety hazard analysis procedures in a manner that 
makes it specific to COLD-SAT. Some of the references used in this 
development were: NSTS 22254, "Methodology for Conduct of NSTS 
Hazard Analyses/" S.O.I. 400-24, "Shuttle System Hazard Analysis 
Procedure;" and, GDSS-TC-87-006A, "Titan/Centaur Hazard Analysis 
Plan." The dimensions were chosen so as to be completely thorough. 
Therefore, there is overlap in a number of areas. The cause 
categories and hazard groups chosen are the items that are 
foreseeable as necessary for a complete evaluation on the COLD- 
SAT program from Feasibility Study through Launch. 
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III. Hazard Definition Approach 

The potential hazards were addressed by asking the generic 
question, "How can (cause category) cause (hazard group) during 
(operational phase)?" In each case a numbering system was 
developed to identify each matrix point according to the specific 
dimensions it encompassed. For example, the first hazard 
definition addresses the question "How can the 
structural/mechanical system cause collision/mechanical damage 
during launch site modifications?" From the matrix (Figure 2) it 
is seen that collision/mechanical damage is the '1' row (hazard 
group) ; structural/mechanical is the ' A' column (cause category) , 
and, launch site modifications is the '1' operational phase. 
Therefore, this definition is given the title of l.A.1.1, with the 
final ' 1 ' added to signify the first (of potentially others) 
definition. 

The answer to the generic questions provided the substance of 
each hazard definition. The definitions were not developed until 
a deep understanding of the entire COLD - SAT system was obtained. 
In addition, prior knowledge of safety information for missile 
systems and satellites (or "lessons learned") was used to help 
obtain a baseline. The technical aspects of the definition were 
arrived at based on sound engineering knowledge and the acquired 
specific system knowledge. Each matrix point was viewed as an 
independent entity (i.e. the definition derived for one operational 
phase involving a certain cause category/hazard group did not 
affect the derivation of a definition for another operational 
phase) . The definitions were then judged on their applicability 
to the COLD-SAT program and its various design phases. Certain 
hazard definitions cannot physically occur on the COLD-SAT system. 
These were judged to be "not applicable to COLD-SAT." All the 
remaining hazard definitions are applicable to COLD-SAT and will 
need to be responded to at some point in the design. .The intent 
of this analysis was to determine which of these definitions need 
a design response as part of the feasibility study. Therefore, 
these definitions needed to be classified as either "not a safety 
concern for feasibility study" or "safety concern that should be 
addressed during preliminary design." The difference between these 
two classifications was that the second provided issues that the 
systems' designers would account for in the preliminary design. 
The first classification was used to baseline issues that will need 
to be addressed during future phases but are not unique enough or 
complex enough to require a design response during the feasibility 

study . , 

Figure 2 shows the completed hazard matrix and Appendix A1 
provides all of the hazard definitions and their respective 
classification. The coding system used for classification is as 
follows : 
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FIGURE 2 COLD~SAT HAZARD MATRIX LeRC Feasibility Study 20 December 1989 
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+ Not applicable to COLD-SAT 

Not a safety concern for feasibility study 

* Safety concern that should be addressed during 

preliminary design 

The structure of the matrix provides for 756 individual cause 
category /hazard group/operational phase definitions (9X7X12) . Each 
of these matrix points, however, is not applicable to COLD-SAT. 
Fourteen (14) cause category /hazard group pairs were deemed to be 
not applicable during any operational phase. A total of forty (40) 
specific definitions were also deemed to be not applicable. 
Therefore, a total of 208 potential hazard definitions are not 
applicable to COLD-SAT reducing the number of potential hazard 
situations evaluated to 588 definitions. Of these, 408 are not a 
safety concern for the feasibility study leaving 140 hazard 
definitions that are a safety concern and should be addressed 
during the preliminary design. These 140 hazard definitions are 
indicated on the matrix with the number that corresponds to the 
operational phase being addressed in that definition. The cause 
category /hazard group pairs that are marked with "N/A" do not have 
any definitions since it can not be envisioned how such a situation 
could arise during the COLD-SAT program. The pairs marked with an 
"0" have definitions, but the definitions are either not a safety 
concern or they are not applicable to the COLD— SAT program. 


756 Matrix Points - Potential Hazard Definitions 

208 Not Applicable for COLD-SAT 

(14 cause category /hazard groups + 40) 

408 Not a safety concern for feasibility study 

140 Safety concern that should be addressed during 

preliminary design 

756 
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IV. Classification Approach 

There are 140 hazard definitions that are classified as a 
"safety concern that should be addressed during preliminary 
design." Not all of these safety concerns have great impacts on 
the design, complexity, and/or cost of COLD-SAT. Therefore, a 
second classification system was developed in order to determine 
which of the identified hazards are major concerns for a 
feasibility study. The basic classification scheme was defined as: 
(1) a major safety concern for preliminary design; (2) a minor 
safety concern for preliminary design; or, (3) addressed during 
feasibility study. 

The rationale for classifying these 140 hazard definitions 
into one of the categories was based on a number of factors. 
First, if an operation will be large in scope in the design effort, 
it was classified as a major concern. An example of this is the 
case of the ordnance used in this system. Although none of the 
proposed ordnance is believed to be of the "Category A" type 
(catastrophic in and of itself) , the ordnance design effort is a 
major consideration due to the work involved in compiling the list 
of uses, evaluating the effects of operation on other functions, 
and evaluating power requirements and effects. Secondly, if an 
operation provides unique safety concerns, or is of catastrophic 
nature of itself or in its timing (i.e. during launch), it was 
classified as a major concern. The prime example of this is the 
use and handling of the liquid hydrogen. Thirdly, if an operation 
has safety requirements specifically mandated, it was considered 
to be addressed during the feasibility study. This is the case in 
the propulsion system design where it is required (by ESMCR 127- 
1 paragraph 3.11) that two barriers be present between the 
hydrazine and the catalyst bed until after launch. Some of the 
hazards were only partially addressed in this manner and therefore 
have been dually classified. All remaining hazards were classified 
as a minor safety concern. This is not to say that these hazards 
are not of a programmatic concern, but that normal pre-launch 
safety analysis and review methods will address these items at 
future phases and these methods will not greatly affect the design, 
complexity, and/or cost of the system. 

COLD-SAT Hazards Analysis Safety Concerns Categories 

* Addressed during Feasibility Study 2 

- incorporated into design 

* Minor safety concern for preliminary design 106 

* Partially addressed; remainder is minor safety concern 19. 

125 

* Major safety concern for preliminary design 11 

* Partially addressed; remainder is major safety concern 2 

13 

TOTAL COLD-SAT FEASIBILITY STUDY SAFETY CONCERNS 140 
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Reasons for Classification as a Major Safety Concern: 


- effort involved to eliminate or control hazard (design effort 
and/or safety effort) 

- timing of potential hazard occurrence (i.e. during countdown or 
launch) 

- scope of potential hazard (i.e. catastrophic result) 

- unique safety requirements 

All items identified as a safety concern are to be tracked 
throughout the program's operation. This safety analysis is 
designed to be used at the various stages of the program as a 
method of thoroughly itemizing hazards and preparing for various 
safety reviews. 
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V. Major Safety Concerns 

A hazard was considered to be a major safety concern if it 
met any of the criteria presented in the preceding section. 
Hazards identified as a minor safety concern will be important 
during the various future design stages but are not considered to 
be "drivers" at the feasibility study phase of the program. 

The following thirteen (13) definitions for a cause 
category/hazard group/operational phase were identified as areas 
that present major safety concerns: 

The Structural/Mechanical system causing Collision/Mechanical 
damage during Countdown (l.A.9.1) 

* Any component on the spacecraft or associated ground support 
equipment could cause mechanical damage if it failed prior to 
or during countdown. The potential hazard is that the failure 
goes undetected and the launch occurs. The safety engineer 
would rely on adequate designs, testing and quality assurance 
to assure that failures will not occur. Furthermore, it is 
critical that there are enough detection methods to alert the 
launch team to any failure. 

The Structural/Mechanical system causing Collision/Mechanical 
damage during Flight Phase I (1. A. 10.1) 

* During flight phase I, the greatest amount of stress and 
vibration will normally occur. Any of the satellite 
components could fail mechanically or structurally and cause 
collision or mechanical damage. The system safety engineer 
must rely on adequate design, testing and quality assurance 
to assure that failures will not occur. If a failure occurs 
during flight phase I, there is no option for evasive or 
corrective actions. 

Ground Support Equipment causing an Electrical Shock/Short during 
Launch Site Modifications (4. 1. 1.1) 

* The launch site is considered ground support equipment and 
there will be many uses of electrical power on the launch 
site. System safety will evaluate the proposed launch site 
modifications during preliminary design to determine the 
potential for electrical shocks/shorts during any operation. 

Pneumatics causing a Fire during Pre-launch Service (5.D.8.1) 

* GH2 is to be loaded prior to launch. This will require all 
electrical service in the area to be terminated or have only 
spark proof electrical components in use during GH2 loading. 
Pad/area safety plans will address the non-mission-unique 
safety requirements; ESMCR 127-1, chapter 5 is applicable. 
The mission-unique activities will be conducted via safety 
approved procedures. 
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The Structural/Mechanical system causing an Explosion during Pre 

launch Service (6. A. 8.1) 

* There will be many pressure vessels used during pre-launch 
services that could explode /implode as a result of 
structural/mechanical damage. The pressures and time-lines, 
as well as the potential for structural/mechanical damage, 
need to be considered during preliminary design. Pad/area 
safety plans will address the non-mission-unique safety 
requirements; ESMCR 127-1, chapter 5 is applicable. The 
mission-unique activities will be conducted via safety 
approved procedures. 

Pneumatics causing an Explosion during Element Tests (6.D.5.1) 

* There will be many element tests requiring pneumatics that 
have the potential for causing explosions/implosions. Test 
plans/procedures will be required for all testing. Design 
factors of safety need to be considered during the preliminary 
design of the pressure vessels that will be included on the 
satellite. System safety will consider all tests for 
potential safety impacts. Upon determination that a test has 
potential for pneumatics causing explosions/implosions, the 
safety engineer will assure that appropriate safety measures 
are known and in place. 

Pneumatics causing an Explosion during System Tests (6.D.7.1) 

* There will be many system tests requiring pneumatics that have 
the potential for causing explosions/implosions. Test 
plans/procedures will be required for all testing. Design 
factors of safety need to be considered during the preliminary 
design of the pressure vessels that will be included on the 
satellite. System safety will consider all tests for 
potential safety impacts. Upon determination that a test has 
potential for pneumatics causing explosions/implosions, the 
safety engineer will assure that appropriate safety measures 
are known and in place. 

The Electrical/Electronics system causing an Explosion during 

Launch Site Modifications (6.E.1.1) 

* The launch site will require explosion-proof electrical boxes 
on any level that may encounter LH2/GH2 . This may require a 
major launch site modification to accommodate the handling of 
LH2/GH2 . 

Ordnance causing an Explosion during Pre-launch Service (6.F.7.1) 

* A project list for the desired pyrotechnic applications needs 
to be compiled and the applications and installation sequence 
should be considered early in the design. System safety 
should be a primary contributor to this effort. 
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Ordnance causing an Explosion during Countdown (6.F.8.1) 

* The sequence of ordnance activation needs to be considered 

early in the design to assure an adequate supply of power and 
to evaluate whether the ordnance firing will impact other 

functions . 

Ordnance causing an Explosion during Flight Phase I (6.F.9.1) 

* The sequence of ordnance activation needs to be considered 

early in the design to assure an adequate supply of power and 
to evaluate whether the ordnance firing will impact other 

functions . 

Ordnance causing an Explosion during Flight Phase II (6. F. 10.1) 

* The sequence of ordnance activation needs to be considered 

early in the design to assure an adequate supply of power and 
to evaluate whether the ordnance firing will impact other 

functions . 

Ordnance causing an Explosion during Payload Separation (6.F.11.1) 

* The sequence of ordnance activation needs to be considered 

early in the design to assure an adequate supply of power and 
to evaluate whether the ordnance firing will impact other 

functions . 

The next step was to identify the systems that each of these 

hazards applies to. Following the system identification, 

identification of safety considerations for each hazard was 

accomplished . 


14 



VI. System Design Approach to Major Safety Concerns 

By combining the information in the preceding sections a 
listing of the major safety concerns for each subsystem has been 
compiled. The following are these lists: 

STRUCTURAL SYSTEM: 

* The structural system will be designed to withstand the stress 
and vibration encountered during flight phase I. In addition, the 
design will keep spacecraft bending within the allowable payload 
envelope, thus avoiding contact with the faring. 

* Adequate testing will be performed to assure that spacecraft 
structural or mechanical failures will not occur and adequate 
controls will be mandated to assure conformances to the design. 

GROUND SUPPORT EQUIPMENT SYSTEM: 

* Non-mission-unique activities will follow the safety requirements 
of ESMCR 127-1. 

* Mission-unique activities will be conducted via safety approved 
procedures . 

* Pressure vessels will be designed to the requirements of MIL-STD- 
1522A. 

* Adequate design, testing, and quality assurance will be performed 
to assure that mechanical ground support equipment failures will 
not occur. 

* Detection methods to alert the launch team -to any failure will 
be provided. 

* All proposed launch site modifications will be evaluated by 
safety to determine the potential for hazards during any operation. 

* All electrical service in the area will be terminated or have 
only spark-proof electrical components in use during GH2 loading; 
LH2 will be remotely loaded. 

* The launch site will require explosion-proof electrical boxes on 
any level that may encounter LH2/GH2. 

OPERATIONS : 

* Non-mission-unique activities will follow the safety requirements 
of ESMCR 127-1. 

* Mission-unique activities will be conducted via safety approved 
procedures . 
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* Mission and ground pressures and time-lines, and their hazard 
potential, will be evaluated by safety and submitted to range 
safety for analysis. 

* The application and installation sequence of all pyrotechnic 
applications will be considered early in the design. Also, the 
sequence of ordnance activation will be evaluated to assure an 
adequate supply of power and to assess the impact of ordnance 
firing on other spacecraft functions. 

EXPERIMENT SYSTEM: 

* Mission-unique activities will be conducted via safety approved 
procedures . 

* Mission pressures and time-lines will be compiled. 

* Pressure vessels will be designed at a minimum to the 
requirements of MIL-STD-1522A. 

* All test plans and procedures will be evaluated and approved by 
safety for all testing. 

* A project list of the desired pyrotechnic applications will be 
compiled (including sequence of activation) . 

PROPULSION SYSTEM: 

* Mission pressures and time-lines will be compiled. 

* Pressure vessels will be designed to the requirements of MIL-STD- 
1522A . 

* All test plans and procedures will be evaluated and approved by 
safety for all testing. 

POWER SYSTEM; 

* A project list of the desired pyrotechnic applications will be 
compiled (including sequence of activation) . 

All of the above safety considerations have become a part of 
the feasibility study design and the resulting baselined 
spacecraft. Obviously, there will be additional safety 

considerations as the program progresses - these should precipitate 
from this baseline analysis. 
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VII. Specific Safety Issues 

Structural Design Considerations 


If the structural/mechanical system caused collision or 
mechanical damage at any point prior to the countdown, there would 
be the opportunity for corrective action at a later time. At 
countdown, however, this opportunity does not exist. Therefore, 
it is imperative that any hazard of this type be detected during 
the countdown. The timing of this event makes it a major safety 
concern. Thus, the structure subsystem must have adequate design 
and testing to avoid any hazard, as well as adequate quality 
assurance programs. Secondly, the ground support equipment must 
provide adequate detection methods that will alert the launch team 
to any improper conditions. 

The spacecraft and launch vehicle will encounter the greatest 
amount of stress and vibration during flight phase I. Therefore, 
this is the "worst-case" that must be designed for. The design 
must include accommodations for bending within the payload envelope 
as well as for the stress levels to be reached at this time. An 
adequate design and testing program and proper quality assurance 
provisions must be made. 

Launch Site Modifications 


Due to the unique nature of COLD-SAT, extensive work will be 
done in the area of launch site modifications. The amount and 
duration of this work combine to make the launch site modifications 
a major safety concern. Since the bulk of this work will be 
accomplished at later design phases, the only safety consideration 
that can be itemized at this time is that all modifications desired 
will be done in accordance with the requirements of ESMCR 127-1. 
Furthermore, all modifications will be approved by range safety and 
the launch site contractor. 

The launch site modifications will be handled by providing a 
COLD-SAT "mission kit" at the start of preparations for the launch. 
This "kit" will be comprised of the plans, procedures, and hardware 
necessary to accomplish all the agreed upon modifications . 


GH2, GHe, and N2H4 Loading Considerations 

The loading of GH2, GHe, and N2H4 during pre-launch servicing 
presents a major safety concern, in addition to requiring major 
launch site modifications. At the time of loading, either all 
electrical service in the area will have to be terminated, or all 
components in use at this time will be required to be spark-proof. 
Range safety (in accordance with ESMCR 127-1) will approve all 
activities and will approve all plans and procedures. A 
significant effort is needed to design the modifications to assure 
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safe operations. 

The ground operations plan calls for the GHe to be loaded in 
the Hazardous Processing Facility (HPF) using existing facilities 
and servicing hardware. The N2H4 will also be loaded in the HPF. 
The N2H4 system consists of flight qualified pressure vessels (at 
pressures higher than COLD-SAT is proposing) and will also use 
existing facilities and equipment. Access to the N2H4 is provided 
through the fairing should downloading of the propellant be 
required. 

Pressure Vessel Design Considerations 

The use of pressure vessels is a major safety concern. COLD- 
SAT uses pressure vessels in its experiment, its propulsion system, 
and in its ground support equipment. The major concern will occur 
during pre-launch service when the vessels are pressurized or 
during element and system tests. It is imperative that these 
vessels be designed with adequate factors of safety. Range safety 
has suggested designing to the requirements of MIL-STD-1522A. In 
addition, the pressure time-line must be evaluated and all 
procedures and plans must be approved by safety. Adequate safety 
measures will be followed, including those in ESMCR 127-1. The 
potential for structural or mechanical damage, and the resulting 
hazards, will also be evaluated. 

The pressure vessel designs are in accordance with the 
following (although these are not necessarily requirements) : 


Pressure Vessel 


qtv specification 


GH2 Vaporizers 2 

GHe Bottles (experiment) 2 

N2H4 Bottles 4 

GHe Pressurant Tanks 2 

LH2 Supply Tank 1 

LH2 Small Receiver Tank 1 

LH2 Large Receiver Tank 1 


MIL-STD-1522A 
MI L-STD- 1522A 

MIL-STD-1522A, flight qualified 
MIL-STD-1522A, flight qualified 
ASME Boiler and Pressure Vessel Code, 
Section VIII, Division 1 
ASME Boiler and Pressure Vessel Code, 
Section VIII, Division 1 
ASME Boiler and Pressure Vessel Code, 
Section VIII, Division 1 


LH2 Handling Considerations 


The loading of the LH2 during pre-launch servicing presents 
the major safety concern, in addition to requiring major launch 
site modifications. Range safety (in accordance with ESMCR 127- 
1) will approve all activities and will approve all plans and 
procedures. A significant effort is needed to design the 
modifications to assure safe operations. 

The launch site will require explosion-proof electrical boxes 
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and equipment on any level that may encounter LH2 . This is a 
feature that is provided by Complex 36/ due to its Centaur 
facilities. In order to minimize safety concerns. Centaur systems 
will be used as much as possible. In addition, loading will be 
r e motely monitored and controlled from the Launch Complex Control 
Room. 

Although the LH2 Supply Tank will be "locked-up" at T-95 sec, 
the capability to vent and drain will remain until the commit to 
launch. 

Pyrotechnic Usacre/Control Consi derations 

Ordnance will be used in a couple of COLD-SAT applications. 
It will be used as part of the power system (solar array 
deployment) and the experiment system (GHe Purge Bag Vent) . 
Although no projected application involves high-explosive devices 
(irrespective of Flight Termination System) , the proper functioning 
of the respective pyrotechnics is essential to maintaining safety. 
Therefore, a list of all uses of ordnance is mandatory as is an 
evaluation that addresses the availability of adequate power, the 
sequence of activation, and the impact on other systems that the 
ordnance firing will have. 

Due to the complexity of the COLD-SAT satellite, it was 
impossible to completely eliminate pyros that will not be 
accessible to ground personnel once the spacecraft is assembled. 
The occurrences were minimized to the activation of the GHe Purge 
Bag Vent. These pyros as well as any pyro that controls a 
hazardous function (i.e. LH2 flow) will be operated from a 
dedicated pyro control box. This box will isolate the pyros 
electrically until F-l day, at which time the flight actuation 
cable will be installed to arm the pyros. The pyro control box 
will be accessible through the fairing access doors. 
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Vila, night Termination System 

The requirements of ESMCR 127-1 chapter 4 specify the use of 
a flight termination system (FTS) unless a waiver is granted by 
Range Safety. For the COLD-SAT Feasibility Study, it was assumed 
that an FTS was needed and the spacecraft system was designed 
accordingly . 

The need for an FTS arises based on two concerns: (1) an 
intact impact of a suborbital spacecraft following premature 
separation from the launch vehicle/ and (2) independent propulsive 
potential of the spacecraft. Due to the relative size of the RCS 
thrusters on COLD-SAT, it can be shown that the spacecraft will 
effectively have no independent propulsive potential. Therefore, 
the FTS concern is with an intact impact of the COLD-SAT LH2 and 
N2H4 vessels. 

The FTS that was baselined for COLD-SAT is referred to as an 
Inadvertent Separation Destruct System (ISDS) . This type of system 
is attached to the launch vehicle and connected to the payload by 
"break-wires." These "break-wires" will trigger the destruct 
mechanism if the payload should separate from the launch vehicle 
prior to the command to do so. The actual system baselined for 
COLD-SAT is the Martin Marietta Explosive Formed Projectile system. 
This system has flown on all the commercial Titans and will fly on 
the Titan IV/Centaur. The system is proposed to be mounted on the 
Centaur payload adapter thereby eliminating the concern of an 
inadvertent on-orbit firing. 
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VIII. Conclu0ion/R*comm«nd*tions/Is0U«s 

The conclusion reached following this feasibility study safety 
analysis is that there does not appear to be any safety-related 
reasons that would make the COLD-SAT program non-feasible . None 
of the major safety concerns are technical constraints. All of the 
safety considerations can be accomplished/ albeit with some effort 
and cost, but do not appear to require extraordinary measures. 

It is recommended that this analysis be used as the starting 
point for all future safety analyses. The analysis and database 
produced are designed to be utilized by other organizations 

involved with the COLD-SAT program. 

However, some simple changes to the hazard matrix would be 
helpful in the future. First, the third dimension, operational 
phase, would be more accurate if described as program phase. 
Secondly, the program phases themselves would be more useful from 
a safety standpoint if they were changed as follows: 


FROM 

10. Flight Phase I 

11. Flight Phase II 

12. Payload Separation 


TO 

Launch 

Payload Separation 
On Orbit 


where launch would indicate the span from lift-off to payload 
separation. This would allow the evaluation of on-orbit safety 
issues such as end— of— life operations and space debris. 

The only issue or concern that arose during the analysis dealt 
with the lack of concrete answers available from range safety. It 
is understandable that they cannot provide definite answers unless 
a firm design exists. Therefore, suggestions (not answers) 
received from range safety became answers to questions and part of 
the design. If all future work remains within the boundaries 
established by the feasibility study there should not be any 
additional safety issues. However, if the design is significantly 
altered, system safety should evaluate the proposed changes for 
programmatic impacts. Therefore, it is imperative that all future 
work be done with both system safety's and range safety's 
knowledge, support, and approval. 


21 



APPENDIX A1 


Hazard Definitions 
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How can the Structural/Mechanical system cause CoUision/M echanical damage during Operational Phase? 
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.11-1 (flight phase II) - No design impact for feasibility study. Any of the satellite components could 

fail mechanically or structurally and cause mechanical damage. The system safety 
engineer must rely on adequate design, testing and QA to assure that failures wil 
not occur. If a failure occurs during flight phase II, there is no option for 
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How can Hazardous Materials cause Collision/Mechanical damage during Operational Phase? 
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How can Environmental conditions cause Collision/Mechanical damage during Operational Phase? 
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How can Pneumatics cause Collision/Mechanical damage during Operational Phase? 
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How can the Electrical/Electronics system cause Collision/Mechanical damage during Operational Phase? 
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How can Ordnance cause Collision/Mechanical damage during Operational Phase? 
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(element test) - No design impact during feasibility study. Test plans /procedures will be required 

for all testing. System safety will consider all tests for potential safety 
impacts. Upon determination that a test may use ordnance that could cause collision 
or mechanical damage during the element tests, the safety engineer will assure that 
appropriate safety measures are known and in place. 
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.12.1 (payload separation) - No design impact during feasibility study. The concept proposed for feasibility 

study does not include any ordnance that has the potential to produce high energy 
fragments that could cause collision or mechanical damage. The use of ordnance will 
be monitored by the system safety engineer to determine if ordnance that could cause 
collision or mechanical damage is proposed for the program. 
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How can Propulsion cause Collision/Mechanical damage during Operational Phase? 






3 >i 


•H 

d 

• 

• 

■ 


O 1 44 

• 

a 

p 1 >i 

a 

a 

a 

• 

0 0 H 

0 44 H 

d 

d 

d 

a 

M P O' H 

d 

M 0 O' H 

o 

0 

o 

d 

0 d -H 

o 

P d *H 

M 

M 

M 

0 

0 0 -H » 

M 

0 0 -H > 

O' 

O' 

O' 

u 

d 0 

O' 

45 0 0 

O' 

H d M 


d M 

-o 

V 

T> 


H 0 0 0 

V 

H H 0 0 

u 

M 

M 

V 

H -H O 0 

M 

H 0 O 0 

<0 • 

<0 • 

0 • 

M . 

•H 44 d 

0 J 

•rl -H d 

N g 

N g 

N g 

0 g 

> d d -rl 

N g 

> 44 d *H 

*0 3 


0 3 

N 3 

0 O O' 

0 3 

d o O' 

d u 

d m 

43 M 

0 P 

0 p *h d 

pd u 

0 0 -r| d 

\ O' 

^ O' 

^ O' 

43 O' 

0 Q 0 0 

^ O' 

0 44 0 0 


Ers 

Ers 

\ 0 
>i M 


&a 

d >i 

o a 

o a 

o a 

I? a 

-o m a+4 . 

o a 

v a 44 . 

O' 



O 

0 O O 0 0 

O' 

0 M O 0 0 

0 0 

0 0 

0 0 

O' 0 

u p n <w o 

0 0 

O O M <44 0 

P 43 

P 43 

44 £ 

0 43 

o a 0 0 

44 43 

o 44 a 0 0 

10 P 

0 P 

0 44 

44 44 

U 0 0 H 

0 44 

M 0 H 

o 

0 

o 

0 

a 44 n a 

0 

a 0 m a 

P 

P 

p 

O P 

^ 0 O 0 

44 

Sp O 0 

0 o 

0 0 

0 o 

0 

0 0 P 43 d 

0 0 

0 0 44 43 d 

CO 

0 

CO 

0 

d P 44 -r| 

0 

d 0 P -H 

d 0 

d 0 

d 0 

0 0 

0 H 

d 0 

0 44 H 

<0 CO 

0 CO 

0 CO 

d « 

H H 0 * *0 

0 0 

H 0 * *0 

O (0 

O 0 

O 0 

0 0 

a H *H 0 d 

O 0 

a h -h 0 c 

43 

43 

43 

O 43 

0 44 44 0 

43 

H 44 44 0 

0 a 

0 a 

0 a 

a 

44 d 0 

0 a 

44 0 d 0 

43 

43 

43 

0 

0 M 0 0 d 

43 

0 0 0 d 

P CO 

44 CO 

44 0 

pd 0 

0 0 44 44 S 

44 0 

0 M 44 44 5 

•H 

•H 

•rl 

44 -rj 

Eh *0 0 0 

•H 

EH 0 O 0 

0 5 

O 43 

o ,d 

d 

•H ip d 

O 43 

v a-P d 

P P 

+4 44 

44 44 

O 44 

0 CM 

P 44 

•h d J2 




44 

* d 0 0 


• 000 

>i d 

>i d 

>1 d 

a 

>i o 0 a 0 

>1 d 

>i d 0 6 0 
T3 0 d 0 M 

H *H 

H -H 

H «H 

>t*H 

0 43 0 M 

H -H 

a-p 


&T3 

H 

aTJ 

d H 0 

44 H 44 0 


do H 0 

44 44 0 

10 0 

0 0 

0 0 

a 0 

0 H 0 0 

0 0 

0 H 0 0 

> 

> 

> 

0 > 

•H 0 0 0 

> 

H 0 0 0 

44 H 

4-4 H 

44 H 

H 

>1 H 44 43 M 

44 H 

th-H 44 43 W 


0 *H 

0 *H 

/it 

0 -H 

zn 

§ 0 

8 0 

8 0 

*0 44 

*0 44 

*0 44 

d 

d 

d 

0 0 

0 0 

0 0 

0 S 

0 S 

0 S 

0 0 

0 0 

0 0 

d H 

d H 

d H 

a 0 

a 0 

a 0 

0 0 

0 0 

0 0 

•H > 

*H > 

•H > 

d -H 

d -H 

d *H 

44 0 

44 0 

44 0 


P P 

•H >1 <d 
HP O' 

*H 0 P fl 
d P 0 -H 

0 0 P 0 


-P *H O' <0 

O' 0 p 0 0 

d >i 0 s 

*h co d 3 0 

M -H T> P 

d 8 0 

-0 • W H *H 

O' 0 <d M 

p a p o a 


P * p d 

•H 0 0 

H >i O' <0 

•H P p C J 

d a) 0 *h S 

•H X M 
« (dP 3 >i 
0 0 TJ P 

0 d 0 
p g o 0 p 
0 -rl O' 10 
OtP P M 
C CO (0 E 

*h >, d 3 0 

P W *H T3 P 
d e fd 
t3 m h -h 
» 0 0 m 
p O' p o a 


0 a 

0 

a 

0 a 

a 

0 44 v 

d 

H 

0 a 

0 

*r| T3 

d M 

rH O 

rH 

o 

H O 

0 o 

a 0 

0 

a 

rH O 

a 

P 

0 a 

d M 

jQ 

M 


H M 

g 0 d 

d 

a 

d m 


0 d 

d a 

0 a 

0 

a 

o3 a 

d a 

-H 44 S 

o 

0 

0 a 

•H 

0 O 

O 0 

o 

O 


0 


a 

0 


o 


p a 

0 

•H o 

•H 

0 

H O 

o o 

d 44 D 

a 

44 

•H O 

d 

„ D 

B P 

h d 

H 

d 

h d 

•h d 

& d 


0 

h d 

O' 

g 

^ 0 

a 

9* 


a 

rH 

■H 0 

d 

d 

& 

•H 

0 

d d 

a 0 

a 

0 

a 0 

a 0 

0 a * 

o 

44 

a 0 

0 

P • 

O P 

0 -H 

0 

•H 

0 -H 

a-H 

000 

•r| 


0 *H 

0 

0 0 

•H 





0 

0 H 44 

0 

9 


*0 

>1 P 

0 0 

44 0 

44 

0 

44 0 

0 

0 0 

■r| 

u 

P 0 


0 0 

*H U 

O M 

0 

M 

O U 

44 U 

O 0 

H 

d 

o u 

0 

0 

H d 

1 2 0 

2 

0 

2 0 

O 0 

2 m a 

H 

0 

2 0 

2 


rH 0 

1 d 


d 

d 

2 d 

o g 

O 

0 

d 


o W 

O 0 

I + eh 

+ 

Eh 

4- Eh 

+ EH 

1 4H *3 

O 

0 

+ Eh 

1 

P *H 

O 0 


o 

>1 

0 

m 

0 

d 

0 

d 

a 

g 

d 

d 

0 

0 

0 

0 

3 

u 

H 

H 

rH 

0 

p 

0 

0 


-w* 

w- 



rH 

rH 

H 

rH 

rH 

rH 

CM 

CO 


in 

d 

d 

d 

d 

d 

rH 

rH 

rH 

rH 

rH 


34 


(prelaunch services) * This could be a design impact that should be considered during the preliminary 

design. To satisfy the requirements of ESMCR 127-1, there must be two barriers 
between the N2H4 and the catalyst beds. These barriers (valves) must be included in 
the design. 



(countdown) * This could be a design inpact that should be considered during the preliminary 

design. To satisfy the requirements of ESMCR 127-1, there must be two barriers 
between the N2H4 and the catalyst beds until after lift off. These barriers 
(valves) must be included in the design. 
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How can Ground Support Equipment cause Collision/Mechanical damage during Operational Phase? 
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.10.1 (flight phase I) + Not applicable: this phase does not apply to the cause 
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How can the Structural/Mechanical system cause Corrosion during Operational Phase? 
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Structural/mechanical 
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How can Hazardous Materials cause Corrosion during Operational Phase? 
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(system integration) - No design impact during feasibility study. System integration will be 

accomplished via procedures and plans. System safety will consider all tests for 
potential safety impacts. Upon determination that an integration process include; 
hazardous materials that could cause corrosion, the safety authority will assure 
that appropriate safety measures are known and in place. 
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How can Environmental conditions cause Corrosion during Operational Phase? 
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2 . C. 12.1 (payload separation) - No design impact during feasibility study. It currently can not be conceived how 

environmental conditions could introduce elements of corrosion during the payload 
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How can Pneumatics cause Corrosion during Operational Phase? 
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potential 



.12.1 (payload separation) * This could be a design impact and should be considered during preliminary design 

The potential for pneumatics causing corrosion such as hydrogen embrittlement will 
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How can the Electrical/Electronics system cause Corrosion during Operational Phase? 
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will be written and used for all assemblies. All assemblies that may have a safety 
impact will be considered by a safety engineer and appropriate safety controls will 
be included in the procedures. The potential for hazards will be reported to HASA 
via safety plans . 
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.11.1 (flight phase II) - No design impact during feasibility study. Currently , it can not be conceived how 

electrical/electronics could cause corrosion during flight. Corrosion is a time- 
related function and the flight phase is a short duration event. 
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.G.12.1 (payload separation) * This could be a design impact that should be considered during the preliminary 

design. The current concept is to release the N2H4 into the thruster loop soon 
after lift off. With the N2H4 in the lines during payload separation there is the 
potential for a fault that would fire the REMs and initiate or cause corrosion. The 
flight sequence needs to be evaluated for potential safety hazards. 
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How can Non-Ionizing Radiation cause Corrosion during Operational Phase? 
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How can Ground Support Equipment cause Corrosion during Operational Phase? 
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12 1 (payload separation) - No design impact during feasibility study. There is insufficient design detail at 

the feasibility study phase of the program to analyze for safety uqpacts. GSE will 
be used during launch to monitor the spacecraft. 
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(element test) - No design impact during feasibility study. Test plans /procedures will be required 

for all testing. System safety will consider all tests for potential safety 
impacts . Upon determination that a test has potential for mechanical /structural 
damage that could cause contamination during element testing , the safety engineer 
will assure that appropriate safety measures are known and in place. 
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How can Hazardous Materials cause Contamination during Operational Phase? 
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.6.1 (system integration) - No design impact during feasibility study. System integration will be 
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How can Pneumatics cause Contamination or become Contaminated during Operational Phase? 
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components to be inoperable and creating a safety hazard- Clean pneumatic systems 
and proper filtering and contaminate detection methods should be considered during 
the preliminary design. 
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.12.1 (payload separation) - No design impact during feasibility study. It currently can not be conceived how 

contamination could cause a potential hazard during payload separation. 
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Contamination by itself does not pose a potential hazard. The results of the contamination must be evaluated to 
determine the potential for a safety hazard. 



How can the Structural/Mechanical system cause an Electrical Shock during Operational Phase? 
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How can Hazardous Materials cause Electrical Shock during Operational Phase? 
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How can Environmental conditions cause Electrical Shock during Operational Phase? 
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4.C.7.1 (system test) - No design impact during feasibility study. Test plans /procedures will be required 

for all testing. System safety will consider all tests for potential safety 
impacts. Upon determination that a test has potential for environmental conditions 
that could cause electrical shock during the system tests, the safety engineer will 
assure that appropriate safety measures are known and in place. 
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How can the Electrical/Electronics system cause Electrical Shock during Operational Phase? 
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How can Ordnance cause Electrical Shock during Operational Phase? 
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.12.1 (payload separation) - No design impact during feasibility study. There is insufficient design detail at 

the feasibility study phase of the program to analyze for safety impacts. System 
safety will evaluate the preliminary design to determine if there is a potential for 
ordnance to cause electrical shock/ shorts during payload separation. 






44 





x 


o 





o 







XI G 


CO 




h x 

(Ji G 

CO 

x> 


fd 


(d o 

•H fd 

4-3 

H 




u a 

XI H 

H 

G 


X 


-H G 

0> 

O 

co 


G 


M (d 

0) M 

X) 

03 


a) 


X H 

o a 


M 


to 


o 

G 

0) 





a> o 


H 

0) 


X 


H X 

O G 

XJ 

X 


fd 


0) 

M -H 

*H 

X) 


X 


M . 

a m 

01 



X 


0) O 0) 

G 

G 

>i 




<0 -H X 

O TJ 

fd 

X 


M 


a m -h 

4-> 

M 



G 


Cu H 

Tj 

4-1 

M 


O 


d) i— t 

H 0) 


O 


o 


O X 0> 

fd h 

to 



o 


G CO X 

*H H 

id 

X 




id G <d 

4-3 fd 

XI 

O 


o 

o* 

G co 

G 4-3 


<d 


X 

0) 

'd 

0) to 

a 

X 



to 

MHO) 

4-3 G 

3 

G 


a> 

<d 

O *H XI 

O *H 

4-3 

O 


M 

X 

X X 

a 

CO 

O 


CD 

Cu 

g 

>1 

>1 



% 


• 3 g 

0) H 

CO 

X 



H 

X O 

X H 

• 

o 


X 

fd 

O 0) 

4-3 fd 

(0 G 

0) 


M 

c 

o o c 

G 

•H O 

M 


O 

O 

x c o 

CO CO 

X -H 

d 


X 

■H 

to fd *r| 

<d G 

E-* 4-3 



CO 

X 

c 4-> 

x 

<d 




id 

H T/ <d 

0) 

G 

>1 


<d 

m 

fd M H 

x) M 

• -H 

X 



m 

O O H 

fd fd 

H e 



X 

a 

*h (d 

X! 

< 3 

M 


H 

o 

M <i> X 

x> Q> • 

CO 4-3 

0) 




X X « 

O TJ 

1 G 

X 




o u c 

0) G fd 

Q O 

X 


• 


0) ’H 

O fd a 

3 o 

♦H 


M 


H O 

G C 

o 

0) 


O 


0) X M 

fd '0 XI 

O M 



X 


a) 

G M O 

O 

H 


fd 


0) TJ X 

■3 O G 

M 

0) 


*«4 


(0 d) M 

M G 

O CO 

G 


X 


G x fd 

o fd 

4-4 4-3 

G 


•H 


fd o 

• H 

c 

O 


G 


o a> « 

>1 CO 

XJ 01 

C0 



Co 

G X 

C CT> 0) 

<u a 

M 



g 

X G M 

fd G XI 

CO & 

£ 


G 

•H 

o o o 

*H 4-3 

O fd 

a 


fd 

M 

g o x 

0) CO 

a ^ 




2 

to 

T3 G 4-3 

O 44 

o 


o * 

TJ 

G X 

G O fd 

M 

X 


X TJ 


<d O M 

H X 

a >i 



M 

M 

O G O 

O M 

& 

>i 


to fd 

o 

4-1 

G M O 

cn m 

M 


H N 

o 

a) co 

■H -H 

G 0) 

G 


fd fd 

XX 

M-Hd 

0) >» 

•H G 

*H 


G X 

CO 

O 0) 

XXX 

a) 0) 

G 




44 M ^ 

O X) H 

x 

■H 


*H H 

H 

a) a> o 

G H 

X 



CO <d 

fd 

m u a> 

G -H 

>i 0" 

to 



o 

a> o xi 

CO -H O 

H -H 

*H 


H X 

-H 

x a o 

0) fd 

4-3 X 



(d G 

m 

X 

0 X) 44 

G 

X 


o d> 

4J 

H 0) 

TJ 0) 

0) d) 

M 


-H X 

u 

XJ fd M 

G Cn 

M O 

O 


M 0 

0) 

G O (d 

>i-H C 

M 5 

X 


x a 

H 

<d ‘H 

XJ fd *H 

G XJ 

CO 


o 

DJ 

M 0) 

G x) co 

O O 

\ 


d) fd 


M 4-3 U 

4-3 G CO 

M 

M 


H 

0> 

a) O G 

CO O 0) 

co a 

O 


0) 0) 

<0 

^ a) d 

O O 

H 

o 


X 


O H C 

>1 1 o 

4-3 

X 


G 

<d 

a a) 'B 

X) 4-1 M 

a o 

to 


<d T5 

u 

M 

■h h a 

3 G 



H 


0 0)0 

H 0) 

4-> 

H 


CT» G 

<D 

-H XI 

•H tO CO 

(0 H 

id 


G O 

u 

M 4-> 0) 

XI G 

>t H 

o 


-H O 

a 

4_> X 

•H H O 

CO *H 

*H 



rd 

O -4-3 

to H d 


M 


G CO 

c 

0> >1 

fd fd M 

G 

X 


d) x 

'O 

H H ■- 

0) <d 

O XJ 

O 


CO H 

M 

0) H >1 

4-1 0) N 

*r| G 

CD 


G 

o 

fd H 

m <d 

4-> fd 

H 


>1 CO 


<D E H 

M fd X! 

fd 

0) 


X 0) 

c 


o 

M XJ 



M 

<d 

id O G 

4-t >» 0) 

<d a) 

M 


TJ 

a 

M Z M 

0) XI 

a g 

O 


<p d) 


o> o 

XJ X 4-» 

<p -H 

44 


X X 

u 

G C 

0) 4-» 

co fd 



(d x 

0 

a) • 

CO 4-3 

4-3 

XJ 


> 

aci 

cn a> - 

o ^ <d 

0) G 

M 


-H 


X 0 

a co 

a o 

fd 

• 

X H 

« , 

4-> <d to 

O 4J M 

>i o 

N 

X 

o id 

to 

i o > H 

M G 0) 

4-3 1 

fd 

M 

fd G 

03 

i G H rtj 

a o) xi 

44 

X 

O 


X 

1 4-3 

6 X) 

a h 


X 

Q) *H 

0 

► o a 

X> &I-H 

a <d 

>i 

CO 

M CO 

c 

1 V <d * 

a fd o) 

rd co 

M 


(d 


G 

0) M 

• — 1 

<d 

M 

TJ 

<0 (DOS 

O 4-1 CO 

o d> 

s 

O 

<D d) 


O X O 

G 0) 

M 

■H 

o 

O G 

M 

1 G T) 

O >, O 

XJ <d 

M 

X 

G C 

c 

> fd M 4-3 

O 

G 

a n 

(d <d 

JC 

! G 0) G 

M f> 

fd 4-3 




X 

> 6 S 3 

0) 0) M 

X <d 

0) 

0) 

d a 


1 MOO 

XI G 0) 

X 

X 

X 

M G 

< 

; o a o 

E-i 0) CO 

< x> 

£4 

X 

O G 


93 



How can Propulsion cause Electrical Shock during Operational Phase? 
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DEFINITIONS 
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How can Ground Support Equipment cause Electrical Shock during Operational Phase? 
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l that is performing the operation to assure that there are adequate 
prevent the hazard from occurring. The potential for hazards will be 
NASA via safety plans. 
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How can the Structural/Mechanical system cause Fire during Operational Phase? 
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How can Hazardous Materials cause Fire during Operational Phase? 
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5. B. 12.1 (payload separation) * This could be a design impact that should be considered during the preliminary 

design. Payload separation involves a shock factor and an ignition source. The 
"program hazardous materials list" will be used to identify the hazards that are 
associated with each material. LH2 pressure control and venting methods need to 
studied during the preliminary design for their potential safety impacts. 
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How can Pneumatics cause Fire during Operational Phase? 
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(system test) - No design impact during feasibility study. Test plans/procedures will be required 

for all testing. System safety will consider all tests for potential safety 
impacts. Upon determination that a test has potential for pneumatics causing fires 
during the system tests, the safety engineer will assure that appropriate safety 
measures are known and in place. 
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could be combustible, but the medium is typically selected as non-combustible to prevent fire hazards. The 
pressurization system for COLD-SAT will use GH2 and GHe. The GH2 will be loaded on the ground. On orbit, GH2 
will be generated from LH2 . Many of the issues are covered in 5.B, Hazardous Materials causes Fires. 



How can the Electrical/Electronics system cause Fire during Operational Phase? 
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Electrical shorts are ignition sources for fires but an electrical short is not considered a fire because it does 
not support the combustion. The combustion sources need to be considered for their potential for causing fires 
and their location in relation to the ignition sources. These considerations are not a concern during the 
feasibility study except for known media such as LH2/GH2, 
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.12.1 (payload separation) - No design impact during feasibility study. During payload separation the ordnance 

will be armed. If they are activated either intentionally or inadvertently, they 
will not provide a potential ignition source because they are self contained. 

During each of the program phases, system safety will review the design of the 
ordnance and determine if there are any potential safety hazards. 
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How can Propulsion cause Fire during Operational Phase? 
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{system test) - No design impact during feasibility study. If any system tests are required on 

the propulsion system, they are normally performed using a flammable medium. A 
system safety authority will review and approve all procedures /plans and will assure 
that adequate safeguards are in place to prevent fires. 



(prelaunch services) * This could be a design impact that should be considered during the preliminary 

design. The hydrazine system is normally charged during prelaunch services and 
adequate safeguards need to be designed into the propulsion to eliminate the risk of 
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(system test) - No design impact during feasibility study. Test plans /procedures will be required 

for all testing. System safety will consider all tests for potential safety 
impacts . Upon determination that a test has potential for fire caused by GSE during 
system tests, the safety engineer will assure that appropriate safety measures are 
known and in place. 
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How can the Structural/Mechanical system cause an Explosion during Operational Phase? 
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atmosphere. If a pressure vessel has sustained prior structural/mechanical damage 
the potential for an explosion/implosion exists during flight phase II. Quality 
assurance and the process and test procedures will i>e relied upon to assure that 
structural/mechanical damage does not occur. 
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(system integration) - No design impact during feasibility study. System integration will be 

accomplished via procedures and plans. System safety will consider all plans for 
potential safety impacts. Upon determination that a process has potential for an 
explosion of hazardous materials during system integration, the safety engineer will 
assure that appropriate safety measures are known and in place. 
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.12.1 (payload separation) * This could be a design impact that should be considered during the preliminary 

design. Payload separation involves a shock factor and an ignition source. The 
"program hazardous materials list” will be used to identify the hazards that are 
associated with each material. LH2 pressure control and venting methods need to 
studied during the preli m inary design for their potential safety impacts. 
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DEFINITIONS 
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How can Pneumatics cause an Explosion during Operational Phase? 
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hazard to an acceptable level 
via safety plans. 
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.11.1 (flight phase II) * This could be a design impact that should be considered during the prel imi nary 

design. Pressure vessels and relief systems on board the satellite need to have 
adequate factors of safety and verification testing to assure that they will 
withstand the launch loads and on-orbit environments. 
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.12.1 (payload separation) * This could be a design impact that should be considered during the preliminary 

design. Any operations scheduled during ascent will be evaluated by the system 
safety engineer for the potential of electrical /electronics providing ignition o 
any combustible atmosphere. 
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How can Ordnance cause an Explosion during Operational Phase? 
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6. G. 12.1 (payload separation) - No design impact during feasibility study. It currently can not be conceived how 

the propulsion system could provide an ignition source that could cause an explosion 
during payload separation. The pyro-isolation valve will be activated soon after 
launch and will supply N2H4 to the thruster valves. The proposed valves have dual 
seats to provide a redundant seal . 
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How can Ground Support Equipment cause an Explosion during Operational Phase? 
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How can the Structural/Mechanical system cause Temperature Extremes during Operational Phase? 
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.5.1 (element test) - No design impact during feasibility study. Test plans /procedures will be require< 

for all testing. System safety will consider all tests for potential safety 
impacts. Upon determination that a test may involve hazardous materials that could 
cause temperature extremes during the element tests, the safety authority will 
assure that appropriate safety measures are known and in place. 
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satellite's or launch vehicle's instrumentation and cause 



.12.1 (payload separation) * This could be a design impact that should be considered during t 

desicm. Hazardous materials could cause temperature extremes that 
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7.C.6.1 (system integration) - No design impact during feasibility study. System integration will be 

accomplished via procedures and plans. System safety will consider all tests for 
potential safety impacts. Upon determination that an environment condition has 
potential for temperature extremes during system integration, the safety engineer 
will assure that appropriate safety measures are known and in place. 
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.12.1 (payload separation) * This could be a design impact that should be considered during the preliminary 

design. The effects of environmental conditions that might cause temperature 
extremes on equipment and operations, such as cold gas purges and cryogenics, will 
be considered during the preliminary design. Where possible, the design will 
eliminate potential for hazards. 
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How can Pneumatics cause Temperature Extremes during Operational Phase? 
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Pneumatics can cause temperature extremes from using cold pressurants or rapidly escaping high pressure gases. 
The temperature extremes could cause critical components to malfunction. 



How can the Electrical/Electronics system cause Temperature Extremes during Operational Phase? 
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How can Ordnance cause Temperature Extremes during Operational Phase? 
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How can Propulsion cause Temperature Extremes during Operational Phase? 
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How can Non-Ionizing Radiation cause Temperature Extremes during Operational Phase? 
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How can Ground Support Equipment cause Temperature Extremes during Operational Phase? 
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Minor Safety Concerns (partially addressed) from COLD-SAT Hazard Analysis 
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Minor Safety Concerns (partially addressed) from COLD-SAT Hazard Analysis 
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Safety Concerns from COLD-SAT Hazard Analysis Addressed During Feasibility Study 



176 


[echamcal; B- Hazardous Materials; C-Enviiomnental; D=Pneumatics; E=Electrical/Electroiiic; F=Ordnance; G^Propclskm; H=Non-Ionizing Radiation; I=GSH 



NASA 

National Aeronautics and 
Space Administration 

1. Report No. 

NASA CR- 187042 


4. Title and Subtitle 


Report Documentation Page 


2. Government Accession No. 


COLD-SAT Feasibility Study Safety Analysis 


3. Recipient’s Catalog No. 


5. Report Date 
January 1991 

6 Performing Organization Code 


7. Author(s) 

Steven T. McHenry and James M. Yost 


9. Performing Organization Name and Address 

Analex Corporation 
21775 Brookpark Road 
Fairview Park, Ohio 44126 

12. Sponsoring Agency Name and Address 

National Aeronautics and Space Administration 
Lewis Research Center 
Cleveland, Ohio 44135-3191 
15. Supplementary Notes 


8. Performing Organization Report No. 


10. Work Unit No. 

506-48 

11. Contract or Grant No. 
NAS3-25515 

13. Type of Report and Period Covered 
Contractor Report 

Final 

14. Sponsoring Agency Code 


Project Manager, Robert G. Rohal, Office of Mission Safety and Assurance, NASA Lewis Research Center. 


16. Abstract 

The Cryogenic On-orbit Liquid Depot — Storage, Acquisition and Transfer (COLD-SAT) satellite presents some 
unique safety issues. The feasibility study conducted at the NASA Lewis Research Center desired a systems 
safety program that would be involved from the initial design in order to eliminate and/or control the inherent 
hazards. Because of this, a hazards analysis method was needed that: (1) identified issues that needed to be 
addressed for a feasibility assessment; and (2) identified all potential hazards that would need to be controlled 
and/or eliminated during the detailed design phases. This report presents the developed analysis method as well 
as the results generated for the COLD-SAT system. 


17. Key Words (Suggested by Author(s)) 

COLD-SAT; Systems safety; Cryogenics; ELV; 
Microgravity experiment design 


18. Distribution Statement 

Unclassified - Unlimited 
Subject Category 18 


19. Security Classif. (of this report) 
Unclassified 


20. Security Classif. (of this page) 
Unclassified 


21. No. of pages 

177 


22. Price* 

A09 


NASA FORM 1626 OCT 86 


*For sale by the National Technical Information Service. Springfield, Virginia 22161 





National Aeronautics and 
Space Administration 


FOURTH CLASS MAIL 


Lewis Research Center address correction requested 

Cleveland, Ohio 44135 

Official Business 

Penalty for Private Urn *300 



Postage and Fees Paid 
National Aeronautics and 
Space Administration 
NASA-451 





